Restricting access to external schemas from within a database level container by whitelisting allowed schemas

Patent metadata

Field	Value
Publication number	US-10674438-B2
Application number	US-201715637698-A
Country	US
Kind code	B2
Filing date	Jun 29, 2017
Priority date	Jun 29, 2017
Publication date	Jun 2, 2020
Grant date	Jun 2, 2020

Abstract

An external database schema permitted to be accessed from a container using a database synonym is determined. A logical schema representing the external database schema is defined. A synonym for the container is defined using the logical schema and an object associated with the external database schema. The logical schema and synonym is deployed to the container using a logical schema plugin. The container is configured to disable the logical schema plugin and to only allow references to the defined logical schemas.

First claim

What is claimed is:

1. A computer-implemented method, comprising:
determining an external database schema permitted to be accessed from a container using a database synonym;
defining a logical schema representing the external database schema;
defining a synonym for the container using the logical schema and an object associated with the external database schema;
deploying the logical schema and synonym to the container using a logical schema plugin;
configuring the container to disable the logical schema plugin; and
configuring the container to only allow references to the defined logical schemas.

2. The computer-implemented method of claim 1 , further comprising defining a logical schema name for the logical schema that is mapped to the external database schema.

3. The computer-implemented method of claim 2 , wherein the mapping of the logical schema name to the external database schema is stored in metadata associated with the container.

4. The computer-implemented method of claim 2 , further comprising resolving the logical schema name to the external database schema when using the defined synonym.

5. The computer-implemented method of claim 1 , wherein permission to access the external database schema is made by agreement with the owner of the external database schema and logical schema names are typically agreed upon by application developers.

6. The computer-implemented method of claim 1 , wherein there is only one logical schema plugin.

7. The computer-implemented method of claim 1 , wherein the logical schema plugin extracts a schema field from a logical schema artifact and persists the schema field as metadata.

8. A non-transitory, computer-readable medium storing one or more instructions executable by a computer system to perform operations comprising:
determining an external database schema permitted to be accessed from a container using a database synonym;
defining a logical schema representing the external database schema;
defining a synonym for the container using the logical schema and an object associated with the external database schema;
deploying the logical schema and synonym to the container using a logical schema plugin;
configuring the container to disable the logical schema plugin; and
configuring the container to only allow references to the defined logical schemas.

9. The non-transitory, computer-readable medium of claim 8 , further comprising one or more instructions to define a logical schema name for the logical schema that is mapped to the external database schema.

10. The non-transitory, computer-readable medium of claim 9 , wherein the mapping of the logical schema name to the external database schema is stored in metadata associated with the container.

11. The non-transitory, computer-readable medium of claim 9 , further comprising one or more instructions to resolve the logical schema name to the external database schema when using the defined synonym.

12. The non-transitory, computer-readable medium of claim 8 , wherein permission to access the external database schema is made by agreement with the owner of the external database schema and logical schema names are typically agreed upon by application developers.

13. The non-transitory, computer-readable medium of claim 8 , wherein there is only one logical schema plugin.

14. The non-transitory, computer-readable medium of claim 8 , wherein the logical schema plugin extracts a schema field from a logical schema artifact and persists the schema field as metadata.

15. A computer-implemented system, comprising:
a computer memory; and
a hardware processor interoperably coupled with the computer memory and configured to perform operations comprising:
determining an external database schema permitted to be accessed from a container using a database synonym;
defining a logical schema representing the external database schema;
defining a synonym for the container using the logical schema and an object associated with the external database schema;
deploying the logical schema and synonym to the container using a logical schema plugin;
configuring the container to disable the logical schema plugin; and
configuring the container to only allow references to the defined logical schemas.

16. The computer-implemented system of claim 15 , further configured to define a logical schema name for the logical schema that is mapped to the external database schema.

17. The computer-implemented system of claim 16 , wherein the mapping of the logical schema name to the external database schema is stored in metadata associated with the container.

18. The computer-implemented system of claim 16 , further configured to resolve the logical schema name to the external database schema when using the defined synonym.

19. The computer-implemented system of claim 15 , wherein permission to access the external database schema is made by agreement with the owner of the external database schema and logical schema names are typically agreed upon by application developers.

20. The computer-implemented system of claim 15 , wherein there is only one logical schema plugin and the logical schema plugin extracts a schema field from a logical schema artifact and persists the schema field as metadata.

Assignees

• Sap Se

Inventors

• Bregler Jonathan
• Bunte Alexander
• Harren Arne
• Kellner Andreas
• Kuntze Daniel
• Lueders Simon
• Sauermann Volker
• Schnaubelt Michael
• Tran Le-Huan Stefan

Classifications

• H04W48/16 Primary

  Discovering, processing access restriction or access information · CPC title

• G06F9/445

  Program loading or initiating (bootstrapping G06F9/4401; security arrangements for program loading or initiating G06F21/57) · CPC title

• G06F16/25 Primary

  Integrating or interfacing systems involving database management systems · CPC title

• G06F8/60

  Software deployment · CPC title

• G06F16/285

  Clustering or classification · CPC title